SB20260916128 - Improper locking in Linux kernel mm

Description

This security bulletin contains information about 1 vulnerability.

1) Improper locking (CVE-ID: CVE-2026-89985)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to improper locking in the memory cgroup folio migration and reparenting logic when migrating folios across NUMA nodes during memory cgroup reparenting. A local user can trigger folio migration across nodes to compromise confidentiality, integrity, and availability.

Memory cgroup reparenting processes one node at a time.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/6165478eaa3094eaee1d5e33b12520064faf043d
• https://git.kernel.org/stable/c/bf4ade7dbd76d4ec8697840e4ebb15ed77c5ec26